Dashboards & Visualizations

How can we detect and display fluctuations of data?

danielbb
Motivator

We would like to detect and display fluctuations of data. So, let's say the count of network events for a certain sourcetype in this month is double than the previous month, we would like to show it in a panel and potentially create an alert for it.

How can we do it? 

Labels (1)
Tags (1)
0 Karma

chirs
Observer

It really depends on what you want, but this is what I do:

 

  1. Build a search which gets run after midnight, so maybe 1 am, as a saved search to gather 30 days worth of data into statistics like max(), min(), avg() and so forth to get you the trend, broken out by day.
  2. Then run a scheduled search at the cadence you want for the same data for today, comparing the values in the lookup table against the data you have for today.
  3. Create an eval to give yourself a "this is about right", "this is too low", "this is too high" kind of status column.
  4. Trigger an alert based on what conditions are not acceptable.
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...